Add digest resolution to cosigned.
#800
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cosigned.cosigned.
|
Marking this as WIP because of the remaining e2e TODO (w/ DO NOT SUBMIT), but I wanted to let the automation do a pass over things while I play with that 😁 |
5a62482
to
fb3011e
Compare
cosigned.cosigned.
|
Okay, this should be RFAL. I've updated the e2e test to check the digest resolution using a dry run on the resources. |
|
@dlorenc this is RFAL 😁 |
cosigned.cosigned.
|
Scratch that, the logs don't look right 🤔 |
This change introduces a mutating webhook to complement our validating webhook. The validating webhook in sigstore#799 began rejecting tag reference because tags are mutable and can drift between validation and resolution by the kubelet. This change introduces a mutating webhook that resolves tags to digests as resources are created, so that users aren't necessarily forced to provide digests, but we get the benefits of them nonetheless. Fixes: sigstore#784 Signed-off-by: Matt Moore <[email protected]>
fb3011e
to
c564e0a
Compare
|
Ok, I fixed the script so it fails properly, and found the bug 🤦 Turns out it doesn't matter if you resolve tags to digests if the digest still isn't signed! I'm optimistic this will pass now 🤞 |
|
💥 https://github.com/sigstore/cosign/pull/800/checks?check_run_id=3709807519#step:13:80 Alright, this is good to go 🎉 |
cosigned.cosigned.
mrjoelkamp
pushed a commit
to mrjoelkamp/cosign
that referenced
this pull request
Sep 28, 2021
This change introduces a mutating webhook to complement our validating webhook. The validating webhook in sigstore#799 began rejecting tag reference because tags are mutable and can drift between validation and resolution by the kubelet. This change introduces a mutating webhook that resolves tags to digests as resources are created, so that users aren't necessarily forced to provide digests, but we get the benefits of them nonetheless. Fixes: sigstore#784 Signed-off-by: Matt Moore <[email protected]> Signed-off-by: Joel Kamp <[email protected]>
mrjoelkamp
pushed a commit
to mrjoelkamp/cosign
that referenced
this pull request
Sep 28, 2021
This change introduces a mutating webhook to complement our validating webhook. The validating webhook in sigstore#799 began rejecting tag reference because tags are mutable and can drift between validation and resolution by the kubelet. This change introduces a mutating webhook that resolves tags to digests as resources are created, so that users aren't necessarily forced to provide digests, but we get the benefits of them nonetheless. Fixes: sigstore#784 Signed-off-by: Matt Moore <[email protected]> Signed-off-by: Joel Kamp <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This change introduces a mutating webhook to complement our validating webhook.
The validating webhook in #799 began rejecting tag reference because tags are mutable and can drift between validation and resolution by the kubelet. This change introduces a mutating webhook that resolves tags to digests as resources are created, so that users aren't necessarily forced to provide digests, but we get the benefits of them nonetheless.
Signed-off-by: Matt Moore [email protected]
Ticket Link
Fixes: #784
Release Note